LiveActive security incident?Get immediate response
CVE Record

CVE-2020-22043: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common functi...

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE describes a memory leak in FFmpeg 4.2 that can cause denial of service. Business impact depends on where FFmpeg is used, especially services that process user-supplied media. The source bundle does not provide CVSS, confirmed affected packages beyond FFmpeg 4.2, a fixed version, or active exploitation evidence.

Executive priority

Prioritize inventory and vendor confirmation rather than emergency response. Escalate if FFmpeg 4.2 processes untrusted media in internet-facing or high-availability services, because denial of service could affect business continuity even without data theft.

Technical view

The reported flaw is a memory leak in `fifo_alloc_common` within `libavutil/fifo.c` in FFmpeg 4.2. The claimed impact is denial of service through memory exhaustion. Available evidence is sparse: no CVSS vector, CWE, fixed release, or detailed affected CPEs are provided in the bundle.

Likely exposure

Exposure is most likely where FFmpeg 4.2 is installed directly or bundled into applications, appliances, media pipelines, upload processors, transcoding services, or security tooling. Confirming exposure requires software inventory and package-level validation because the CVE record lists affected vendor/product as unspecified.

Exploitation context

The provided bundle does not show CISA KEV listing or any cited source confirming active exploitation. Treat exploitation status as unconfirmed. The practical concern is denial of service against workloads that parse or process media with the vulnerable FFmpeg code path.

Researcher notes

The record is thin: it names FFmpeg 4.2, `fifo_alloc_common`, `libavutil/fifo.c`, and denial of service via memory leak. It does not include CVSS, CWE, exploit evidence, detailed affected ranges, or a fixed commit/version. Avoid assuming broader product impact without local proof.

Mitigation direction

  • Inventory FFmpeg deployments and embedded copies, prioritizing systems processing untrusted media.
  • Check FFmpeg ticket 8284 and package maintainer advisories for official remediation guidance.
  • Apply vendor-supported FFmpeg updates when available; no fixed version is identified in this bundle.
  • Review service memory limits and restart behavior for exposed media-processing workloads.

Validation and detection

  • Confirm installed FFmpeg versions on hosts, containers, appliances, and application dependencies.
  • Identify whether FFmpeg 4.2 or embedded libavutil code is present in production paths.
  • Review media upload, transcoding, and scanning services for unauthenticated or untrusted input exposure.
  • Track vendor advisory status because the bundle does not provide complete affected-version metadata.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-22043 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.